@jungjaehoon/mama-core 2.4.1 → 4.0.0

package/db/migrations/062-refresh-connector-event-sequences.sql

@@ -1,114 +1,10 @@
-ALTER TABLE connector_event_index
-  ADD COLUMN operator_observation_seq INTEGER CHECK (
-    operator_observation_seq IS NULL OR operator_observation_seq >= 1
-  );
+-- Retired: this migration declared the observation sequence on the connector event index.
+--
+-- The index moved to the package that has connectors. Three of the four consumers
+-- of this core have none, and were running these statements against tables they
+-- never write. The schema is declared whole in standalone/db/migrations/001.
+--
+-- The file stays, and the number stays claimed: databases in the field recorded
+-- 62 as applied, and a number that comes back meaning something else is worse
+-- than a number that means nothing.
 
-CREATE TABLE IF NOT EXISTS connector_event_index_observation_cursors (
-  source_connector TEXT PRIMARY KEY,
-  next_seq INTEGER NOT NULL CHECK (next_seq >= 1)
-);
-
-WITH ranked AS (
-  SELECT event_index_id,
-         ROW_NUMBER() OVER (
-           PARTITION BY source_connector
-           ORDER BY source_timestamp_ms, rowid
-         ) AS seq
-  FROM connector_event_index
-)
-UPDATE connector_event_index
-SET operator_observation_seq = (
-  SELECT seq FROM ranked WHERE ranked.event_index_id = connector_event_index.event_index_id
-);
-
-INSERT INTO connector_event_index_observation_cursors (source_connector, next_seq)
-SELECT source_connector, MAX(operator_observation_seq) + 1
-FROM connector_event_index
-GROUP BY source_connector
-ON CONFLICT(source_connector) DO UPDATE SET next_seq = CASE
-  WHEN connector_event_index_observation_cursors.next_seq < excluded.next_seq
-  THEN excluded.next_seq
-  ELSE connector_event_index_observation_cursors.next_seq
-END;
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_connector_event_index_observation_seq
-  ON connector_event_index(source_connector, operator_observation_seq)
-  WHERE operator_observation_seq IS NOT NULL;
-
-CREATE TRIGGER IF NOT EXISTS trg_connector_event_index_operator_ingest_seq_au
-AFTER UPDATE OF operator_ingest_seq ON connector_event_index
-WHEN NEW.operator_ingest_seq IS NULL AND OLD.operator_ingest_seq IS NOT NULL
-BEGIN
-  INSERT INTO connector_event_index_operator_seq_cursors
-    (source_connector, channel, next_seq)
-  VALUES (NEW.source_connector, COALESCE(NEW.channel, ''), 1)
-  ON CONFLICT(source_connector, channel) DO NOTHING;
-  UPDATE connector_event_index
-  SET operator_ingest_seq = (
-    SELECT next_seq FROM connector_event_index_operator_seq_cursors
-    WHERE source_connector = NEW.source_connector
-      AND channel = COALESCE(NEW.channel, '')
-  )
-  WHERE event_index_id = NEW.event_index_id;
-  UPDATE connector_event_index_operator_seq_cursors
-  SET next_seq = next_seq + 1
-  WHERE source_connector = NEW.source_connector
-    AND channel = COALESCE(NEW.channel, '');
-END;
-
-CREATE TRIGGER IF NOT EXISTS trg_connector_event_index_observation_seq_ai
-AFTER INSERT ON connector_event_index
-WHEN NEW.operator_observation_seq IS NULL
-BEGIN
-  INSERT INTO connector_event_index_observation_cursors
-    (source_connector, next_seq)
-  VALUES (NEW.source_connector, 1)
-  ON CONFLICT(source_connector) DO NOTHING;
-  UPDATE connector_event_index
-  SET operator_observation_seq = (
-    SELECT next_seq FROM connector_event_index_observation_cursors
-    WHERE source_connector = NEW.source_connector
-  )
-  WHERE event_index_id = NEW.event_index_id;
-  UPDATE connector_event_index_observation_cursors
-  SET next_seq = next_seq + 1
-  WHERE source_connector = NEW.source_connector;
-END;
-
-CREATE TRIGGER IF NOT EXISTS trg_connector_event_index_observation_seq_au
-AFTER UPDATE OF operator_observation_seq ON connector_event_index
-WHEN NEW.operator_observation_seq IS NULL AND OLD.operator_observation_seq IS NOT NULL
-BEGIN
-  INSERT INTO connector_event_index_observation_cursors
-    (source_connector, next_seq)
-  VALUES (NEW.source_connector, 1)
-  ON CONFLICT(source_connector) DO NOTHING;
-  UPDATE connector_event_index
-  SET operator_observation_seq = (
-    SELECT next_seq FROM connector_event_index_observation_cursors
-    WHERE source_connector = NEW.source_connector
-  )
-  WHERE event_index_id = NEW.event_index_id;
-  UPDATE connector_event_index_observation_cursors
-  SET next_seq = next_seq + 1
-  WHERE source_connector = NEW.source_connector;
-END;
-
-CREATE TRIGGER IF NOT EXISTS trg_connector_event_index_observation_seq_explicit_ai
-AFTER INSERT ON connector_event_index
-WHEN NEW.operator_observation_seq IS NOT NULL
-BEGIN
-  INSERT INTO connector_event_index_observation_cursors
-    (source_connector, next_seq)
-  VALUES (NEW.source_connector, 1)
-  ON CONFLICT(source_connector) DO NOTHING;
-  UPDATE connector_event_index_observation_cursors
-  SET next_seq = CASE
-    WHEN next_seq <= NEW.operator_observation_seq THEN NEW.operator_observation_seq + 1
-    ELSE next_seq
-  END
-  WHERE source_connector = NEW.source_connector;
-END;
-
-INSERT INTO schema_version (version, description)
-VALUES (62, 'Refresh connector event delivery and observation sequences');

package/db/migrations/063-refresh-legacy-connector-event-updates.sql

@@ -1,33 +1,10 @@
-SELECT content_hash, metadata_json, source_timestamp_ms, source_type, channel,
-       operator_ingest_seq, operator_observation_seq
-FROM connector_event_index
-LIMIT 0;
+-- Retired: this migration declared the legacy content refresh trigger on the connector event index.
+--
+-- The index moved to the package that has connectors. Three of the four consumers
+-- of this core have none, and were running these statements against tables they
+-- never write. The schema is declared whole in standalone/db/migrations/001.
+--
+-- The file stays, and the number stays claimed: databases in the field recorded
+-- 63 as applied, and a number that comes back meaning something else is worse
+-- than a number that means nothing.
 
-CREATE TRIGGER IF NOT EXISTS trg_connector_event_index_legacy_content_refresh_au
-AFTER UPDATE OF content_hash, metadata_json, source_timestamp_ms, source_type, channel
-ON connector_event_index
-WHEN (
-  OLD.content_hash IS NOT NEW.content_hash
-  OR OLD.metadata_json IS NOT NEW.metadata_json
-  OR OLD.source_timestamp_ms IS NOT NEW.source_timestamp_ms
-  OR OLD.source_type IS NOT NEW.source_type
-  OR OLD.channel IS NOT NEW.channel
-) AND (
-  NEW.operator_ingest_seq IS OLD.operator_ingest_seq
-  OR NEW.operator_observation_seq IS OLD.operator_observation_seq
-)
-BEGIN
-  UPDATE connector_event_index
-  SET operator_ingest_seq = CASE
-        WHEN NEW.operator_ingest_seq IS OLD.operator_ingest_seq THEN NULL
-        ELSE NEW.operator_ingest_seq
-      END,
-      operator_observation_seq = CASE
-        WHEN NEW.operator_observation_seq IS OLD.operator_observation_seq THEN NULL
-        ELSE NEW.operator_observation_seq
-      END
-  WHERE event_index_id = NEW.event_index_id;
-END;
-
-INSERT OR IGNORE INTO schema_version (version, description)
-VALUES (63, 'Refresh sequences for legacy connector event updates');

package/db/migrations/067-add-connector-event-source-entity-id.sql

@@ -1,14 +1,10 @@
--- Migration 067: give connector_event_index a first-class source_entity_id so an agent can read an
--- entity's change history (the revisions save() preserves) through the same grant-bounded core index
--- it already searches. Previously sourceEntityId lived only inside metadata_json, with no by-entity
--- query. Additive and backward-compatible: existing rows are backfilled from metadata_json.
-ALTER TABLE connector_event_index ADD COLUMN source_entity_id TEXT;
+-- Retired: this migration declared the source entity id on the connector event index.
+--
+-- The index moved to the package that has connectors. Three of the four consumers
+-- of this core have none, and were running these statements against tables they
+-- never write. The schema is declared whole in standalone/db/migrations/001.
+--
+-- The file stays, and the number stays claimed: databases in the field recorded
+-- 67 as applied, and a number that comes back meaning something else is worse
+-- than a number that means nothing.
 
-UPDATE connector_event_index
-  SET source_entity_id = json_extract(metadata_json, '$.sourceEntityId')
-  WHERE source_entity_id IS NULL
-    AND metadata_json IS NOT NULL
-    AND json_extract(metadata_json, '$.sourceEntityId') IS NOT NULL;
-
-CREATE INDEX IF NOT EXISTS idx_connector_event_source_entity
-  ON connector_event_index(source_connector, source_entity_id);

package/db/migrations/069-create-registry-nodes.sql

@@ -0,0 +1,52 @@
+-- Registry: the one place that says "these names are the same thing".
+--
+-- A work item or a person is a node; every spelling it is known by is an alias row. Records
+-- and tasks point at the node, so a fact filed under one spelling and a task titled with
+-- another still join.
+--
+-- Merging is a decision, never a similarity guess. Alias uniqueness is keyed by kind and
+-- visibility scope, so a contested alias inside one scope is explicit while separate scopes
+-- may use the same spelling independently.
+
+CREATE TABLE IF NOT EXISTS registry_nodes (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('item', 'person', 'client')),
+  name TEXT NOT NULL,
+  -- Set when an owner correction splits one item into the files it really covers.
+  parent_id TEXT REFERENCES registry_nodes(id) ON DELETE SET NULL,
+  -- Set when this node was merged away; resolution follows the pointer to the survivor.
+  merged_into TEXT REFERENCES registry_nodes(id) ON DELETE SET NULL,
+  merge_reason TEXT,
+  note TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_registry_nodes_kind ON registry_nodes(kind, merged_into);
+CREATE INDEX IF NOT EXISTS idx_registry_nodes_parent ON registry_nodes(parent_id);
+
+CREATE TABLE IF NOT EXISTS registry_aliases (
+  node_id TEXT NOT NULL REFERENCES registry_nodes(id) ON DELETE CASCADE,
+  kind TEXT NOT NULL CHECK (kind IN ('item', 'person', 'client')),
+  -- Case- and space-normalised at write time; the display form stays in `alias_display`.
+  alias TEXT NOT NULL,
+  alias_display TEXT NOT NULL,
+  scope_kind TEXT NOT NULL CHECK (scope_kind IN ('global', 'user', 'channel', 'project')),
+  scope_id TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  PRIMARY KEY (kind, alias, scope_kind, scope_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_registry_aliases_node ON registry_aliases(node_id);
+CREATE INDEX IF NOT EXISTS idx_registry_aliases_scope
+  ON registry_aliases(kind, alias, scope_kind, scope_id);
+
+CREATE TABLE IF NOT EXISTS registry_scope_bindings (
+  node_id TEXT NOT NULL REFERENCES registry_nodes(id) ON DELETE CASCADE,
+  scope_kind TEXT NOT NULL CHECK (scope_kind IN ('global', 'user', 'channel', 'project')),
+  scope_id TEXT NOT NULL,
+  PRIMARY KEY (node_id, scope_kind, scope_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_registry_scope_lookup
+  ON registry_scope_bindings(scope_kind, scope_id, node_id);

package/db/migrations/070-record-identity.sql

@@ -0,0 +1,35 @@
+-- What a record is about, and who was involved, as references instead of prose.
+--
+-- The only statement of subject used to be the `topic` text. `item_id` points at a
+-- registry node, so two spellings of one item join.
+--
+-- `record_actors` is a table rather than a column because one record routinely involves
+-- several people in different roles - the person who did the work, the one who relayed it,
+-- the client contact. The single `assignee` slot on a task was losing that distinction, and
+-- putting it back as one column would lose it again. The role is free text: production work
+-- and a booking do not share a role vocabulary, and the registry holds the person while the
+-- role belongs to this record.
+--
+-- No foreign key to registry_nodes: the store validates the node and its kind before
+-- writing, and a merge rewrites nothing (readers canonicalise through merged_into), so a
+-- database-level constraint would only add a failure mode without adding a guarantee.
+
+ALTER TABLE decisions ADD COLUMN item_id TEXT;
+
+-- Only the item. A composite index over
+-- COALESCE(event_datetime, created_at) was tried first and broke recovery of databases whose
+-- schema_version is newer than their structure - event_datetime arrives in migration 030 and
+-- is not guaranteed to exist when this one runs.
+CREATE INDEX IF NOT EXISTS idx_decisions_item ON decisions(item_id);
+
+CREATE TABLE IF NOT EXISTS record_actors (
+  record_id TEXT NOT NULL REFERENCES decisions(id) ON DELETE CASCADE,
+  person_id TEXT NOT NULL,
+  role TEXT NOT NULL,
+  -- Insertion order, so the actor list reads back the way the agent stated it.
+  position INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  PRIMARY KEY (record_id, person_id, role)
+);
+
+CREATE INDEX IF NOT EXISTS idx_record_actors_person ON record_actors(person_id, record_id);

package/db/migrations/071-service-operation-origins.sql

@@ -0,0 +1,187 @@
+-- Migration 071: a truthful service/CLI operation can trace itself.
+--
+-- tool_traces was model-only: model_run_id was NOT NULL with an FK to
+-- model_runs, so a host operation could be recorded only by forging a fake
+-- model run. This migration relaxes that: model_run_id becomes nullable, and
+-- an operation-origin row is anchored instead by a nonempty operation_id and
+-- actor_principal_id. A CHECK forbids a row with neither origin. Legacy rows
+-- keep their model id and semantics; the model_runs FK is preserved.
+--
+-- WHY A TABLE REBUILD: dropping the NOT NULL on model_run_id and adding a CHECK
+-- cannot be done with ALTER; SQLite requires create/copy/drop/rename. This SQL
+-- file rebuilds the canonical (post-068) column set and is what the plain
+-- applyAll test path runs. The migration runner special-cases version 71 with a
+-- dynamic rebuild that additionally preserves any extra runtime columns/indexes/
+-- triggers a live database may carry (see node-sqlite-adapter). Both produce the
+-- same canonical shape. The rebuild copies every existing row and re-creates
+-- every 033/061/068 index; nothing is dropped.
+--
+-- GUARD: this canonical-only direct-SQL path can express ONLY the exact pre-071
+-- canonical tool_traces (the fresh 033/061/068 chain: 17 columns with fixed
+-- types/NOT NULL/DEFAULT/PK, one FK to model_runs, the PK auto-index, and the
+-- four 033/068 named indexes). It copies no origin values and carries no
+-- triggers, embedded constraints, custom/unique indexes or referencing children
+-- across the rebuild. Against anything else it would SILENTLY DROP it (a runtime
+-- column, a changed column constraint/default, an embedded CHECK/UNIQUE, an
+-- extra outgoing FK, a trigger, a custom/unique index, an already-present
+-- operation_id / actor_principal_id value) or CASCADE-delete a referencing child
+-- row on the DROP TABLE. Production extended-schema upgrades must instead go
+-- through the dynamic adapter path, which preserves all of those verbatim. So
+-- this guard fails LOUDLY, before altering any data, on any deviation from the
+-- exact canonical pre-071 shape: the CHECK on _migration071_guard aborts the
+-- whole script if the CASE evaluates to 0.
+--
+-- This is a strict canonical-shape precondition (a fingerprint of the known
+-- fresh pre-071 chain), NOT a general SQL migration engine and NOT a policy on
+-- the production adapter. It enumerates the full canonical column tuples, the
+-- single canonical FK, exactly one auto-index (the PK), and rejects embedded
+-- CHECK text, triggers, extra explicit indexes, and referencing children.
+-- NOTE: the pre-071 canonical shape has NO operation_id/actor_principal_id
+-- columns (071 adds them); their presence means a noncanonical source this path
+-- cannot faithfully carry.
+
+CREATE TEMP TABLE _migration071_guard (ok INTEGER NOT NULL CHECK (ok = 1));
+INSERT INTO _migration071_guard (ok)
+SELECT CASE
+  -- (1) column count must be exactly the 17 canonical columns (catches an extra
+  --     column - including an already-present origin column this path cannot
+  --     copy - and a missing column).
+  WHEN (SELECT count(*) FROM pragma_table_info('tool_traces')) <> 17 THEN 0
+  -- (2) every column must match the canonical (name, type, NOT NULL, DEFAULT, PK)
+  --     tuple. Catches a renamed/extra column, a changed column constraint, a
+  --     changed default, and an already-present operation_id/actor_principal_id.
+  WHEN EXISTS (
+    SELECT 1 FROM pragma_table_info('tool_traces') ti
+    WHERE NOT EXISTS (
+      SELECT 1 FROM (
+        SELECT 'trace_id' AS cname, 'TEXT' AS ctype, 0 AS cnn, NULL AS cdflt, 1 AS cpk
+        UNION ALL SELECT 'model_run_id', 'TEXT', 1, NULL, 0
+        UNION ALL SELECT 'gateway_call_id', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'tool_name', 'TEXT', 1, NULL, 0
+        UNION ALL SELECT 'input_summary', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'output_summary', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'execution_status', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'duration_ms', 'INTEGER', 0, '0', 0
+        UNION ALL SELECT 'envelope_hash', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'created_at', 'INTEGER', 1, NULL, 0
+        UNION ALL SELECT 'failure_code', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'diagnostic_json', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'evidence_json', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'catalog_revision', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'owner_scope', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'project_id', 'TEXT', 0, NULL, 0
+        UNION ALL SELECT 'channel_id', 'TEXT', 0, NULL, 0
+      ) canon
+      WHERE canon.cname = ti.name
+        AND canon.ctype = ti.type
+        AND canon.cnn = ti."notnull"
+        AND canon.cpk = ti.pk
+        AND ((canon.cdflt IS NULL AND ti.dflt_value IS NULL) OR canon.cdflt = ti.dflt_value)
+    )
+  ) THEN 0
+  -- (3) the outgoing FK set must be exactly the single canonical model_runs FK
+  --     (catches an extra or changed outgoing FK).
+  WHEN (SELECT count(*) FROM pragma_foreign_key_list('tool_traces')) <> 1 THEN 0
+  WHEN NOT EXISTS (
+    SELECT 1 FROM pragma_foreign_key_list('tool_traces')
+    WHERE "from" = 'model_run_id' AND "table" = 'model_runs' AND "to" = 'model_run_id'
+  ) THEN 0
+  -- (4) no embedded CHECK constraint. pragma does not expose CHECK, so scan the
+  --     stored CREATE TABLE text; the canonical shape carries no CHECK keyword.
+  WHEN EXISTS (
+    SELECT 1 FROM sqlite_master
+    WHERE type = 'table' AND name = 'tool_traces' AND instr(upper(sql), 'CHECK') > 0
+  ) THEN 0
+  -- (5) exactly one auto-index (the trace_id PK). An embedded UNIQUE constraint
+  --     (table- or column-level) adds a second sql-IS-NULL auto-index; merely
+  --     ignoring sql-IS-NULL auto-indexes would silently drop it on rebuild.
+  WHEN (
+    SELECT count(*) FROM sqlite_master
+    WHERE type = 'index' AND tbl_name = 'tool_traces' AND sql IS NULL
+  ) <> 1 THEN 0
+  -- (6) any trigger on tool_traces (DROP/RENAME would not carry it).
+  WHEN EXISTS (
+    SELECT 1 FROM sqlite_master WHERE type = 'trigger' AND tbl_name = 'tool_traces'
+  ) THEN 0
+  -- (7) any non-canonical explicit index on tool_traces (a user/unique index
+  --     with its own CREATE statement this path does not recreate).
+  WHEN EXISTS (
+    SELECT 1 FROM sqlite_master
+    WHERE type = 'index' AND tbl_name = 'tool_traces' AND sql IS NOT NULL
+    AND name NOT IN (
+      'idx_tool_traces_model_run_id', 'idx_tool_traces_gateway_call_id',
+      'idx_tool_traces_scope_recency', 'idx_tool_traces_channel_recency'
+    )
+  ) THEN 0
+  -- (8) any table that references tool_traces - the DROP TABLE below would
+  --     CASCADE-delete its rows. Detected via the per-table FK list.
+  WHEN EXISTS (
+    SELECT 1 FROM sqlite_master m
+    WHERE m.type = 'table' AND m.name NOT LIKE 'sqlite_%' AND m.name <> 'tool_traces'
+    AND EXISTS (
+      SELECT 1 FROM pragma_foreign_key_list(m.name) fk WHERE fk."table" = 'tool_traces'
+    )
+  ) THEN 0
+  ELSE 1
+END;
+DROP TABLE _migration071_guard;
+
+CREATE TABLE tool_traces_071_new (
+  trace_id TEXT PRIMARY KEY,
+  model_run_id TEXT,
+  gateway_call_id TEXT,
+  tool_name TEXT NOT NULL,
+  input_summary TEXT,
+  output_summary TEXT,
+  execution_status TEXT,
+  duration_ms INTEGER DEFAULT 0,
+  envelope_hash TEXT,
+  created_at INTEGER NOT NULL,
+  failure_code TEXT,
+  diagnostic_json TEXT,
+  evidence_json TEXT,
+  catalog_revision TEXT,
+  owner_scope TEXT,
+  project_id TEXT,
+  channel_id TEXT,
+  operation_id TEXT,
+  actor_principal_id TEXT,
+  CHECK (
+    (model_run_id IS NOT NULL AND operation_id IS NULL AND actor_principal_id IS NULL)
+    OR (
+      operation_id IS NOT NULL AND length(trim(operation_id)) > 0
+      AND actor_principal_id IS NOT NULL AND length(trim(actor_principal_id)) > 0
+    )
+  ),
+  FOREIGN KEY (model_run_id) REFERENCES model_runs(model_run_id)
+);
+
+INSERT INTO tool_traces_071_new (
+  trace_id, model_run_id, gateway_call_id, tool_name, input_summary, output_summary,
+  execution_status, duration_ms, envelope_hash, created_at, failure_code,
+  diagnostic_json, evidence_json, catalog_revision, owner_scope, project_id, channel_id
+)
+SELECT
+  trace_id, model_run_id, gateway_call_id, tool_name, input_summary, output_summary,
+  execution_status, duration_ms, envelope_hash, created_at, failure_code,
+  diagnostic_json, evidence_json, catalog_revision, owner_scope, project_id, channel_id
+FROM tool_traces;
+
+DROP TABLE tool_traces;
+ALTER TABLE tool_traces_071_new RENAME TO tool_traces;
+
+CREATE INDEX IF NOT EXISTS idx_tool_traces_model_run_id
+  ON tool_traces(model_run_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_tool_traces_gateway_call_id
+  ON tool_traces(gateway_call_id);
+CREATE INDEX IF NOT EXISTS idx_tool_traces_scope_recency
+  ON tool_traces(owner_scope, project_id, created_at DESC, trace_id DESC);
+CREATE INDEX IF NOT EXISTS idx_tool_traces_channel_recency
+  ON tool_traces(owner_scope, project_id, channel_id, created_at DESC, trace_id DESC);
+CREATE INDEX IF NOT EXISTS idx_tool_traces_operation_id
+  ON tool_traces(operation_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_tool_traces_actor_principal
+  ON tool_traces(actor_principal_id, created_at DESC);
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (71, 'Service operation-origin tool traces');

package/db/migrations/072-observation-versions.sql

@@ -0,0 +1,29 @@
+-- Immutable source observations. The current event index points at the exact captured version;
+-- retention of the mutable index never deletes the historical observation.
+CREATE TABLE IF NOT EXISTS observation_versions (
+  observation_id TEXT PRIMARY KEY,
+  source TEXT NOT NULL CHECK (length(trim(source)) > 0),
+  source_id TEXT NOT NULL CHECK (length(trim(source_id)) > 0),
+  producer_version_id TEXT,
+  body TEXT,
+  body_location_json TEXT,
+  author TEXT,
+  source_at INTEGER,
+  observed_at INTEGER NOT NULL,
+  content_hash TEXT NOT NULL CHECK (length(trim(content_hash)) > 0),
+  metadata_json TEXT NOT NULL,
+  scope_json TEXT NOT NULL,
+  CHECK ((body IS NOT NULL AND body_location_json IS NULL)
+      OR (body IS NULL AND body_location_json IS NOT NULL))
+);
+
+CREATE INDEX IF NOT EXISTS observation_source_versions
+  ON observation_versions(source, source_id, observed_at, observation_id);
+
+-- `connector_event_index.current_observation_id` was added here. The index belongs
+-- to the package that has connectors and declares that column itself; the core no
+-- longer knows the table exists. The direction it records is unchanged, and it was
+-- always the right one: the index points at the observation.
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (72, 'Immutable connector and owner observation versions');

package/db/migrations/073-registry-corrections.sql

@@ -0,0 +1,45 @@
+-- Atomic, scoped identity corrections. Migration 069 remains the authority for aliases and
+-- scope bindings; correction history extends that schema without rewriting it.
+CREATE TABLE IF NOT EXISTS registry_identity_state (
+  singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+  revision INTEGER NOT NULL CHECK (revision >= 0)
+);
+INSERT OR IGNORE INTO registry_identity_state (singleton, revision) VALUES (1, 0);
+
+CREATE TABLE IF NOT EXISTS registry_corrections (
+  command_id TEXT PRIMARY KEY,
+  operation TEXT NOT NULL CHECK (operation IN ('add_alias', 'merge', 'split', 'assign_refs')),
+  expected_revision INTEGER NOT NULL CHECK (expected_revision >= 0),
+  committed_revision INTEGER NOT NULL UNIQUE CHECK (committed_revision > expected_revision),
+  principal_id TEXT,
+  agent_id TEXT,
+  origin TEXT NOT NULL CHECK (origin IN ('trusted', 'legacy_unattributed')),
+  payload_json TEXT NOT NULL,
+  reason TEXT NOT NULL CHECK (length(trim(reason)) > 0),
+  evidence_json TEXT NOT NULL,
+  scope_json TEXT NOT NULL,
+  receipt_json TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  CHECK (
+    (origin = 'trusted' AND principal_id IS NOT NULL AND length(trim(principal_id)) > 0
+      AND agent_id IS NOT NULL AND length(trim(agent_id)) > 0)
+    OR (origin = 'legacy_unattributed' AND principal_id IS NULL AND agent_id IS NULL)
+  )
+);
+
+CREATE TABLE IF NOT EXISTS registry_ref_assignments (
+  command_id TEXT NOT NULL REFERENCES registry_corrections(command_id) ON DELETE CASCADE,
+  edge_id TEXT NOT NULL,
+  endpoint TEXT NOT NULL CHECK (endpoint IN ('from', 'to')),
+  original_kind TEXT NOT NULL,
+  original_id TEXT NOT NULL,
+  resolved_node_id TEXT REFERENCES registry_nodes(id),
+  committed_revision INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  PRIMARY KEY (command_id, edge_id, endpoint)
+);
+CREATE INDEX IF NOT EXISTS idx_registry_ref_assignments_current
+  ON registry_ref_assignments(edge_id, endpoint, committed_revision DESC);
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (73, 'Atomic scoped registry correction history');

package/db/migrations/074-work-graph-ref-kinds.sql

@@ -0,0 +1,39 @@
+-- Extend work-graph reference kinds without rewriting edge identity or provenance.
+ALTER TABLE twin_edges RENAME TO twin_edges_legacy_074;
+CREATE TABLE twin_edges (
+  edge_id TEXT PRIMARY KEY,
+  edge_type TEXT NOT NULL CHECK (edge_type IN ('supersedes','builds_on','debates','synthesizes','mentions','derived_from','case_member','alias_of','next_action_for','blocks')),
+  subject_kind TEXT NOT NULL CHECK (subject_kind IN ('memory','case','entity','report','edge','registry','observation')),
+  subject_id TEXT NOT NULL,
+  object_kind TEXT NOT NULL CHECK (object_kind IN ('memory','case','entity','report','edge','raw','registry','observation')),
+  object_id TEXT NOT NULL,
+  relation_attrs_json TEXT,
+  confidence REAL NOT NULL DEFAULT 1.0 CHECK (confidence >= 0.0 AND confidence <= 1.0),
+  source TEXT NOT NULL CHECK (source IN ('agent','human','code')),
+  agent_id TEXT,
+  model_run_id TEXT,
+  envelope_hash TEXT,
+  human_actor_id TEXT,
+  human_actor_role TEXT,
+  authority_scope_json TEXT,
+  reason_classification TEXT,
+  reason_text TEXT,
+  evidence_refs_json TEXT,
+  request_idempotency_key TEXT,
+  edge_idempotency_key TEXT,
+  content_hash BLOB NOT NULL CHECK(length(content_hash)=32),
+  created_at INTEGER NOT NULL
+);
+INSERT INTO twin_edges SELECT * FROM twin_edges_legacy_074;
+DROP TABLE twin_edges_legacy_074;
+CREATE INDEX idx_twin_edges_subject ON twin_edges(subject_kind, subject_id, created_at DESC);
+CREATE INDEX idx_twin_edges_object ON twin_edges(object_kind, object_id, created_at DESC);
+CREATE INDEX idx_twin_edges_model_run_id ON twin_edges(model_run_id, created_at DESC);
+CREATE INDEX idx_twin_edges_request_idempotency
+  ON twin_edges(model_run_id, request_idempotency_key, created_at DESC)
+  WHERE model_run_id IS NOT NULL AND request_idempotency_key IS NOT NULL;
+CREATE UNIQUE INDEX ux_twin_edges_model_run_edge_idempotency
+  ON twin_edges(model_run_id, edge_idempotency_key)
+  WHERE model_run_id IS NOT NULL AND edge_idempotency_key IS NOT NULL;
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (74, 'Registry and observation work graph references');

package/db/migrations/075-agent-judgments.sql

@@ -0,0 +1,58 @@
+-- Core-owned judgment and commitment command bindings.
+-- Existing decisions, registry, observations, edges, and effect receipts remain authoritative.
+
+ALTER TABLE decisions ADD COLUMN record_kind TEXT NOT NULL DEFAULT 'legacy'
+  CHECK (record_kind IN ('legacy', 'judgment', 'commitment'));
+ALTER TABLE decisions ADD COLUMN payload_json TEXT NOT NULL DEFAULT '{}'
+  CHECK (json_valid(payload_json));
+ALTER TABLE decisions ADD COLUMN applies_from INTEGER;
+ALTER TABLE decisions ADD COLUMN applies_until INTEGER;
+
+CREATE TABLE IF NOT EXISTS command_bindings (
+  command_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL CHECK (length(trim(principal_id)) > 0),
+  action TEXT NOT NULL CHECK (length(trim(action)) > 0),
+  payload_hash TEXT NOT NULL CHECK (length(trim(payload_hash)) > 0),
+  receipt_kind TEXT NOT NULL CHECK (receipt_kind IN ('judgment', 'observation', 'identity', 'effect')),
+  receipt_key TEXT NOT NULL CHECK (length(trim(receipt_key)) > 0),
+  created_at INTEGER NOT NULL CHECK (created_at >= 0)
+);
+
+CREATE TABLE IF NOT EXISTS judgment_commands (
+  command_id TEXT PRIMARY KEY REFERENCES command_bindings(command_id) ON DELETE RESTRICT,
+  record_id TEXT NOT NULL REFERENCES decisions(id) ON DELETE RESTRICT,
+  committed_watermark INTEGER NOT NULL CHECK (committed_watermark >= 0),
+  receipt_json TEXT NOT NULL CHECK (json_valid(receipt_json)),
+  created_at INTEGER NOT NULL CHECK (created_at >= 0)
+);
+
+CREATE TABLE IF NOT EXISTS commitments (
+  task_id INTEGER PRIMARY KEY AUTOINCREMENT,
+  commitment_id TEXT NOT NULL UNIQUE,
+  current_revision INTEGER NOT NULL CHECK (current_revision >= 1),
+  head_record_id TEXT NOT NULL REFERENCES decisions(id) ON DELETE RESTRICT,
+  withdrawn INTEGER NOT NULL DEFAULT 0 CHECK (withdrawn IN (0, 1)),
+  created_at INTEGER NOT NULL CHECK (created_at >= 0),
+  updated_at INTEGER NOT NULL CHECK (updated_at >= 0)
+);
+
+CREATE TABLE IF NOT EXISTS commitment_assignments (
+  commitment_id TEXT NOT NULL REFERENCES commitments(commitment_id) ON DELETE RESTRICT,
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  record_id TEXT NOT NULL REFERENCES decisions(id) ON DELETE RESTRICT,
+  operation TEXT NOT NULL CHECK (operation IN ('create', 'revise', 'withdraw')),
+  set_json TEXT NOT NULL CHECK (json_valid(set_json)),
+  clear_json TEXT NOT NULL CHECK (json_valid(clear_json)),
+  applies_from INTEGER,
+  applies_until INTEGER,
+  created_at INTEGER NOT NULL CHECK (created_at >= 0),
+  PRIMARY KEY (commitment_id, revision),
+  UNIQUE (commitment_id, record_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_judgment_commands_record ON judgment_commands(record_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_commitments_head ON commitments(head_record_id);
+CREATE INDEX IF NOT EXISTS idx_commitment_assignments_record ON commitment_assignments(record_id);
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (75, 'Core-owned agent judgment and commitment commands');

package/db/migrations/076-scoped-checkpoint-bindings.sql

@@ -0,0 +1,15 @@
+-- Checkpoints are readable only when their explicit scope is bound. Legacy rows remain unscoped.
+
+CREATE TABLE IF NOT EXISTS checkpoint_scope_bindings (
+  checkpoint_id INTEGER NOT NULL REFERENCES checkpoints(id) ON DELETE CASCADE,
+  scope_id TEXT NOT NULL REFERENCES memory_scopes(id) ON DELETE RESTRICT,
+  is_primary INTEGER NOT NULL DEFAULT 0 CHECK (is_primary IN (0, 1)),
+  created_at INTEGER NOT NULL CHECK (created_at >= 0),
+  PRIMARY KEY (checkpoint_id, scope_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_checkpoint_scope_bindings_scope
+  ON checkpoint_scope_bindings(scope_id, checkpoint_id DESC);
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (76, 'Scoped checkpoint bindings');